# OTPilot Authenticator

> Generate 2FA codes in a master-password-encrypted vault, with host-matched autofill, encrypted cloud backup, and security tips.

Canonical page: [https://chrome-stats.com/d/otpilot-authenticator](https://chrome-stats.com/d/otpilot-authenticator)

## Overview

- **ID:** `otpilot-authenticator`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** Hank
- **Category:** privacy-security
- **Daily users:** 1
- **Weekly downloads:** 1
- **Version:** 8.0.5
- **Last updated:** 2026-07-28
- **First published:** 2026-07-17
- **Size:** 4.28 MB
- **Data as of:** 2026-09-07
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/otpilot-authenticator/)
- **Website:** [https://github.com/Hank076/Authenticator/issues](https://github.com/Hank076/Authenticator/issues)

## Description

OTPilot Authenticator generates two-factor authentication (2FA) codes right in your
browser, so you don't need to reach for your phone to sign in.

WHAT'S NEW IN THIS VERSION
• Encryption now runs on the browser's native Web Crypto — the vault is sealed with
  AES-GCM authenticated encryption (Argon2id-derived key, a fresh random IV per
  record). Tampered data or a wrong password fails loudly instead of silently
  decrypting into a wrong code.
• Domain binding added — a code is only ever typed into the exact host the account
  was saved for.
• Cloud upload stays fully disabled until a master password is set, so an
  unencrypted vault can never be uploaded.
• Lighter on the pages you visit — QR scanning runs in the extension's own
  background worker, so only a few dozen KB is injected into your tabs.
• Rebuilt QR engine — scanning moved to an actively maintained decoder for more
  reliable recognition, and the QR generator was upgraded to its latest version.

KEY FEATURES
• Standard 2FA codes — time-based (TOTP) and counter-based (HOTP) one-time passwords,
  compatible with Google, GitHub, AWS, and any service that supports authenticator apps.
• Encrypted vault — protect your accounts with a master password. Secrets are encrypted
  with Argon2id key derivation and AES-GCM, and the vault auto-locks after a set idle time.
• Host-matched autofill — fill the current code into the matching site's login field with
  one shortcut. Codes are only injected when the page's host matches the saved account.
• Encrypted cloud backup (optional) — back up your encrypted vault to your own Dropbox.
  Backups stay encrypted; only you can decrypt them with your master password.
• Easy import — scan a QR code, enter a key manually, or import from Google Authenticator.
• Security Advisor — surfaces practical tips to keep your 2FA setup safe.

PRIVACY
Your 2FA secrets never leave your device unencrypted. OTPilot does not run analytics and
does not send your data to its developer. Cloud backup is opt-in and goes only to your own
cloud account.

Open source (MIT) — based on the Authenticator extension
(<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/ef2c04c06a125b4178c19712a52fbf9ce295edae688dcedb13bb9abf506a11e3/http%3A//github.com/Authenticator-Extension/Authenticator" rel="nofollow">github.com/Authenticator-Extension/Authenticator</a>).
Source: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/fd2a1ed543c044630ea4557d09f7c97ce69033b8d74137f3a9e4180275c416e0/https%3A//github.com/Hank076/Authenticator" rel="nofollow">https://github.com/Hank076/Authenticator</a>

## Rankings

- #101,405 — Overall
- #139 — ai copilot
- #177 — copilot

## Permissions and access

### Permissions

- `activeTab`
- `storage`
- `identity`
- `alarms`
- `scripting`

### Host permissions

- `https://www.google.com/`
- `https://*.dropboxapi.com/*`

## Safety

- **Risk impact:** Moderate risk impact
- **Risk likelihood:** High risk likelihood

### Analysis details

- Request access to the following domains: google.com, dropboxapi.com
- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [Authenticator](https://chrome-stats.com/d/authenticator_mozilla) — 335 users, 4.00 / 5
- [2FA](https://chrome-stats.com/d/2fa_exten) — 90 users
- [2FAFast Authenticator](https://chrome-stats.com/d/2fafast-authenticator) — 8 users
- [2! Authenticator](https://chrome-stats.com/d/2-authenticator) — 16 users
- [2FA Authenticator](https://chrome-stats.com/d/2fa_fire) — 36 users
- [SafePass Authenticator](https://chrome-stats.com/d/safepass-authenticator) — 1 users
- [Authi.me: 2FA TOTP with Sync](https://chrome-stats.com/d/authi) — 2 users, 3.67 / 5
- [Offline 2FA Generator](https://chrome-stats.com/d/offline-2fa-generator) — 84 users, 4.00 / 5
- [AuthZ Pro – Authenticator Extension for PC Browser](https://chrome-stats.com/d/authz-pro) — 1 users
- [TOTP Authenticator](https://chrome-stats.com/d/2fa-authenticator) — 13 users
- [Auth Plus](https://chrome-stats.com/d/foxauth) — 42 users, 4.56 / 5
- [OTPilot](https://chrome-stats.com/d/otpilot)

---

Source: [Chrome-Stats](https://chrome-stats.com/d/otpilot-authenticator)